netui-config needs to be able to configure the writability of the pageFlow / sharedFlow binding contexts

Details

Description

Currently, the pageFlow and sharedFlow implicit objects are data bindable from a browser with:

{pageFlow.foo}

or

{sharedFlow.foo}

This can lead to manipulation of values exposed from the pageFlow / sharedFlow to JSPs in ways that weren't intended. While this can be used to expose properties on a JPF as if the JPF itself was a form bean, it's often the case that a JPF needs to expose read-only data to a JSP that isn't web-writable.

The netui-config file and the expression language need to support preventing this type of expression-based update by allowing an app developer to constrain the list of writable implict objects.